CVE Vulnerability Catalog

CloudNativePG before versions 1.28.4 and 1.29.2 opened superuser connections without pinning search_path, allowing a role with DATABASE OWNER to execute attacker-controlled functions as the postgres superuser, including OS command execution and access to the pod ServiceAccount token.

CloudNativePG prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements. With pg_stat_statements and track_utility enabled, an untrusted tenant with pg_monitor or pg_read_all_stats could recover platform-managed passwords and execute OS commands in the database pod. Fixed in 1.28.4, 1.29.2, and 1.30.0.

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script content, and the script executed in another user's browser when that user replayed the recording. This issue is fixed in version 3.0.29.

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting. akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala did not verify the presentation's meeting identifier before deletion, allowing a presenter who knew the identifier to delete another meeting's presentation and disrupt its availability. This issue is fixed in version 3.0.29.

Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.

Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the journey. Any ordinary authenticated user can enumerate sequential journey IDs and retrieve tokens from journey_share_tokens for another user's journey. The token grants unauthenticated access through GET /api/public/journey/:token to the shared journey's entries, captions, locations, moods, gallery photos, photo paths, and asset identifiers. This issue is fixed in version 3.1.0.

TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in server/src/services/mapsService.ts. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: 'follow' instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation. An authenticated trip member can reach the list-import routes, and any authenticated user can reach /api/maps/resolve-url, allowing blind GET requests to internal services without response-body reflection. This issue is fixed in version 3.1.0.

TREK before 3.1.0, when the Journey add-on is enabled, interpolates the unescaped activeSuggestion.title value into suggestion text and renders it with dangerouslySetInnerHTML. A trip owner can store HTML in a title, which is executed in a collaborator's session.

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.

Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom X-Kerberos-Hub-PrivateKey and X-Kerberos-Hub-PublicKey request headers to the operator-configured Hub URL (config.HubURI). The HTTP client used (&http.Client{} in UploadKerberosHub) is constructed without a CheckRedirect policy, so it follows HTTP redirects automatically. Go's net/http strips only sensitive headers (Authorization, Cookie, WWW-Authenticate) on a cross-host redirect; it does not strip custom headers such as X-Kerberos-Hub-PrivateKey. As a result, if the configured HubURI returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the CheckRedirect strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork.

LinkAce before version 2.5.7 does not validate URL format in the Bulk Link API endpoint, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser, enabling theft of cookies and session tokens. Version 2.5.7 fixes this issue.

SFTPGo from 2.2.0 to 2.7.3, the inline query parameter on file downloads suppresses Content-Disposition: attachment, allowing attacker-controlled HTML files to be served as text/html in the web origin.

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticated requester who can reach a public share can select a canonical path outside the shared directory when the target path begins with the shared directory's name, such as a sibling path that shares the same prefix. The endpoint then includes the out-of-scope file in the generated download, disclosing its contents. This issue is fixed in version 2.7.3.

Mailu before version 2024.06.52 has a missing authorization check in the REST API, allowing any unauthenticated attacker to remove IP restrictions or update the comment field of any existing user token if the REST API is enabled. Upgrade to version 2024.06.52 includes a patch, and a workaround is to disable the REST API.

BigBlueButton before version 3.0.23 allows authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers. The method interpolates these values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.

BigBlueButton before version 3.0.23 exposed /bigbluebutton/api/handleJoinExistingUser, which was a routable controller action rather than a private helper. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting. This issue is fixed in version 3.0.23.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause kernel memory corruption due to insufficient validation. A crafted filesystem image can trigger an out-of-bounds kernel-stack write during directory reads, causing a system crash or potentially enabling privilege escalation.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 have a vulnerability in cmdnim that may allow an unprivileged local user to execute the payload as root.

In IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1, a stack memory corruption vulnerability exists in the IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service.